16 docs tagged with "containers"

Binary and auditable checklist to assess the practical adoption of the practices prescribed in Chapter 09 - Containers and Images

Generation, versioning and use of SBOMs as evidence of composition, not as proof of security

Principles, practices and controls for building, validating and running images in a secure, auditable and traceable way

Identification and technical analysis of vulnerabilities in containers as a risk signal, not as an automatic decision

Specifics of exception management in the context of containers and images - admission control, image signing and vulnerability scanning

Minimisation, hardening and effective verification of permissions in images and containerised environments

How to apply the prescribed container security practices throughout the development and operations lifecycle

Validation of the provenance and integrity of container images as technical evidence, not as an execution decision

Technical and operational indicators for the assessment of the effectiveness of security controls in container images and orchestration environments, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Organisational policies required to guarantee the security, traceability and governance of containers and images throughout the lifecycle.

Complete example of a CI/CD pipeline with execution of *containers* in a secure and validated environment

Identification and mitigation of the risks introduced by automation in the chain of building, validation and execution of container images

Selection, hardening and validation of secure base images for containers

Organisational policy that defines the security requirements for the building, scanning, signing, runtime configuration and management of container images, including securityContext hardening, admission policies in Kubernetes, network isolation and runtime monitoring, proportional to the criticality level (L1, L2, L3).

Effective application and verification of security, isolation and control practices for containerised workloads

Automatic application of formal policies to block non-compliant executions, without replacing human decision